Encryption Key Management via Segmented File Keys

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing encryption solutions face challenges in managing and sharing encryption keys, leading to vulnerabilities such as loss of access to multiple encrypted files if a single key is lost, and unauthorized access when a key is shared.

Innovation Solution

A method and system that utilize a key management server and an encryption service module to create and manage encryption keys, ensuring secure sharing of encrypted content and key recovery by generating unique keys for each document and user, and encrypting these keys to secure storage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If one encryption key is used to encrypt many files, then key management is simplified, but losing the key makes many encrypted files vulnerable and sharing the key allows unauthorized access to files the person should not have access to

Engineering Contradiction:

Improveencryption key management complexityVSAvoidsecurity of encrypted files

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent divides the single encryption key approach into multiple file-specific encryption keys. Each encrypted file has its own unique encryption key, so that losing one key only affects that specific file, not all files. This segmentation resolves the contradiction by maintaining simplified key management (through centralized storage and automatic generation) while improving security (through isolation of key compromise).

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an encryption key management service as an intermediary between users and encrypted files. This service automatically generates, stores, and manages encryption keys, eliminating the need for users to manually manage multiple keys while ensuring each file has its own secure key. The intermediary handles key distribution and rotation, resolving the contradiction between simplified management and enhanced security.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If a unique encryption key is created for each file, then damage from key loss is minimized, but a lot of encryption keys need to be managed and stored separately from encrypted documents

Engineering Contradiction:

Improvedamage from key lossVSAvoidencryption key management

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges the encryption key storage with the encrypted file storage by embedding the encryption key within the encrypted file metadata or header. Instead of storing keys separately in external key stores, the system combines the key and encrypted content into a single portable unit. This resolves the contradiction by maintaining file-specific keys (limiting damage from loss) while eliminating the complexity of separate key management systems.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent implements self-service encryption key management where the encryption service automatically generates, associates, and manages encryption keys for each file without requiring user intervention. The system autonomously handles key creation, storage, and retrieval, eliminating the manual complexity of tracking and managing multiple keys while maintaining the security benefit of file-specific keys.

Inventive Principle:

Principle #25Self-service

3Reliability

If encryption keys are stored separately from encrypted documents, then security is improved, but it is difficult to tell how long encryption keys need to be maintained

Engineering Contradiction:

ImprovesecurityVSAvoidkey maintenance duration determination

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by embedding retention policies and expiration metadata directly into the encrypted file structure at the time of encryption. The key maintenance duration is predetermined and specified when the file is created, allowing the system to automatically manage key lifecycle without requiring separate tracking. This resolves the contradiction by maintaining separate key storage (for security) while providing clear, pre-defined key maintenance timelines.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20250167981A1Sharing Encrypted Documents Within and Outside an Organization

Publication Date: 2025.05.22 NEXTLABS INC

AI summary

A method and system of creating and managing encryption keys that facilitates sharing of encrypted content. The system may include an information management system with a key management server and a computing device having an encryption service module. The encryption service module detects operations at the computing device and encrypts a document with an encryption key created using user information and a secret.